Getting Data In

Is it possible to re-index lost AD logs?

dantimola
Communicator

Good Day fellow splunkers,

I just like to ask if is it still possible to re-index lost Windows Active Directory logs? Let's say, AD logs from a month a go. The reason why the logs lost is probably because of network issue. Please check my inputs.conf below.

[admon://default]
disabled = 0
monitorSubtree = 1
index = ad

Cheers,
Dan

0 Karma
1 Solution

DalJeanis
Legend

Okay, the answer depends on what you mean by "lost", and what you mean by "reindex".

If the log never got to splunk, but a copy is somewhere else that you can access, then YES. (search "manual load data")

If the log never got to splunk, and is not somewhere else that you can access, then NO.

If the log got to splunk, was indexed or went to the null queue, and the incoming log file was sent to oblivion and was not backed up, then NO. You got what you got.

If the log got to splunk, was indexed correctly or incorrectly, and the system is set up to move ingested files to a backup location, then YES. (Search for "reindex data")

If the log got to splunk, was indexed correctly, then got frozen and rolled off and you want it loaded back in, then YES. (Search for "reload frozen")

View solution in original post

0 Karma

DalJeanis
Legend

Okay, the answer depends on what you mean by "lost", and what you mean by "reindex".

If the log never got to splunk, but a copy is somewhere else that you can access, then YES. (search "manual load data")

If the log never got to splunk, and is not somewhere else that you can access, then NO.

If the log got to splunk, was indexed or went to the null queue, and the incoming log file was sent to oblivion and was not backed up, then NO. You got what you got.

If the log got to splunk, was indexed correctly or incorrectly, and the system is set up to move ingested files to a backup location, then YES. (Search for "reindex data")

If the log got to splunk, was indexed correctly, then got frozen and rolled off and you want it loaded back in, then YES. (Search for "reload frozen")

0 Karma
Get Updates on the Splunk Community!

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...